Blind Spots in Industrial Cybersecurity: What False Confidence Could Cost You

[00:00:00] Craig: Perception is reality in some sense, and don't be fooled by something that you believe. Back it up with science back it up with data Make sure that you understand where you're at and don't just take someone's word for it trust but verify Hi, my name is Dino Boussalaki. Craig, how you doing, man?

[00:00:49] Craig: I'm doing great. How are you doing, Dino?

[00:00:52] Dino: Thumbel's Friday.

[00:00:53] Craig: I can't get here fast enough, brother.

[00:00:55] Dino: NCAA basketball tournament's right around the corner.

[00:00:59] Craig: Oh, this is March Madness coming up soon, isn't it?

[00:01:01] Dino: yeah, gotta get to the division of conferences, and then we'll be on our way to the NCAA championship run. So,

[00:01:08] Craig: Perfect.

[00:01:09] Dino: fun time.

[00:01:10] Craig: what do you think we should talk about today? You want me to come up with something or you want to come up with something?

[00:01:14] Dino: Your turn,

[00:01:14] Craig: All right. How about if I were to guess, let's talk about perception versus reality

[00:01:22] Dino: okay?

[00:01:23] Craig: the OT space. Meaning, is an organization really prepared or do they just believe they're prepared?

[00:01:34] Dino: I would say they don't know what they don't know, to be honest.

[00:01:37] Craig: the true statement. Yeah.

[00:01:38] Dino: Right, you know, hope is not a strategy, and I think a lot of them kind of fall to that particular model. we've witnessed organizations that have had material breaches, have had ransomware that has shut them down, and they've opted to pay the money. Keys back so they can get back up and running and we can also witness those that have decided to fight it and then spent the next several months trying to get out of the hole that they're in at the tune of tens of millions or more, and losses. and then come out of that and still not make a move and trying to figure out how to solve this problem.

[00:02:13] Craig: Yeah. No. And I, think that we are seeing organizations continue to spend. We are seeing organizations continuing to increase budgets, but we're not seeing the. Attacks slow down. We are not seeing organizations be out of the woods yet, if that's terminology. Maybe that's not the right word, but

[00:02:37] Dino: right. They are, they're very real. and there's even bigger issues that are very cost, they're very costly. And that is just their internal, disruption they cause upon themselves, With interrupting their ability to make goods and they're not pursuing these tools.

[00:02:51] Dino: And I think a lot of it falls back is they just don't have the right. People most likely in their organization really understand, one, the industrial control system environment at that particular plant, much less, you know, thinking that you might have 20, plants in your fleet. Well, that's a lot of dynamics.

[00:03:11] Dino: That's a lot of variables, right? And no 1 or 2 people are going to have a good grasp. Of that, somebody sitting in the enterprise from a global perspective, versus what the people who work within that environment deal with day in and day out. So, I would say a lot of them they just don't have the right resources in place to do this.

[00:03:31] Craig: well, and some of that you look at the budgeting. You look at the recent you mentioned resources. Is it not so much? Not the right? Or is it not enough? Is it not the correct skill sets that go along with that? Combination of all of those you think it's because again Organizations are they're starting to figure this out.

[00:03:53] Craig: They are really I believe Trying to take the right steps in the right direction and i'm seeing organizations In my daily conversations that are what we've preached for the last five years You have to do something to get better period over period and they are Getting better. I just don't know that they are where they need to be Given where the industry is And the amount of ramp time they've had in the last five years.

[00:04:24] Dino: but you just said that something that the CTO from arm is just conveyed to me a little while ago is, Doing something. Are you doing something? You know, are you really trying to understand what your blind spots are and what's critical to your operations? would say, working for one of the nation's largest, system integrators, the food and beverage industry.

[00:04:44] Dino: How often do we get called into a meeting on a project that we're getting ready to, start developing with a client and the CI or the CISO or any other people are actually sitting in the room. As part of the discussion, to bring their concerns and requirements and policies and governance to the table on a 20 million piece of equipment that's going to be designed and built.

[00:05:08] Dino: It's going into their plan,

[00:05:09] Craig: Yeah, it doesn't happen

[00:05:10] Dino: right? I mean, the question is, why is that? Is it a comfort zone for them that they don't want to get out of their comfort zone?

[00:05:17] Craig: Part of it, I think, or people inherently are not comfortable discussing, talking about engaging in things that they're not familiar with. it's that step out of the box mentality to get out of your comfort zone and truly own that or truly embrace yourself and try and help figure it out.

[00:05:36] Craig: that I saw is like around 25%. 25 percent of organizations do not have a comprehensive OT asset monitoring platform. Is it, they're trying to get more depth and they're not comfortable with what they're getting from the platform they're using? Are they afraid to implement it?

[00:05:57] Craig: They've not rolled it out, but what, you know, why it's, they're here,

[00:06:02] Dino: frameworks, right? Have they chosen a security framework? And maybe IT's picked one. Maybe they're working on a security framework. But is it going across the entire organization, including your manufacturing environment, all the way down into those control systems that are sitting in that plant?

[00:06:18] Dino: And, and they have to get past the myth that they think those systems are isolated. You know, if a client tells you that these critical machines in our manufacturing environment are not connected, can they demonstrate that? And maybe, maybe they do, I would say, in almost all of those particular instances, there's either a drop on the wall.

[00:06:40] Dino: For them to connect that machine to the plant network for some third party to get to. Or, somebody walks into the plant computer, an engineer who's coming in to work on that, the OEM, and plugging into that. And that machine sitting on the Wi Fi network or has a cellular hotspot connection out.

[00:06:59] Dino: And now what they thought was not connected, is connected. in the same time, you don't know what they're doing to that machine. You don't know what the work it is that they're doing. You don't know what they're leaving, what they're taking, what they're changing. And so, for those, that have that mindset, where the plants say, don't worry about that equipment, it's not online, don't believe them. like a gun. All guns are loaded. Every single gun's loaded. Do you know it's unloaded or not? You treat that gun as if it's loaded.

[00:07:26] Craig: have to.

[00:07:27] Dino: It is,

[00:07:28] Craig: Safety first. Back to safety.

[00:07:30] Dino: Back to safety. We're

[00:07:31] Craig: to safety. Whether it's, a gun safety, it's a plant safety. if you are the CEO of any company that has manufacturing all the way down to, a facility's maintenance guy, that facility, if you go through the doors of that manufacture facility out onto that plant, the very first thing top of mind, I don't care who you are and what your role is, better be safety on that plant floor.

[00:07:54] Craig: It's ingrained in everyone. It's gotta be the same.

[00:07:58] Dino: so what's gonna happen, what's happening now, is if, those organizations have not started driving an OT cybersecurity strategy into their manufacturing environment, just like safety, getting back to that, that OT ecosystem is gonna start bringing tools and technology, and they already have. Into your plans in order for them to be successful.

[00:08:20] Dino: We've already seen them doing that with remote access, right? If you don't have a really good remote access strategy, they're going to bring in their SACOMIAs and their E1s and their TASI boxes and their cradle point cellular modems. They're going to bring in their own stuff

[00:08:33] Craig: They are.

[00:08:34] Dino: and they're going to start bringing and they are bringing in their own OT cybersecurity tools right for their startups and their commissioning and for their responsibilities for maintenance and support.

[00:08:43] Dino: So they will do it with or without you. So you have to decide as an organization, whether you're going to try to get your arms around this or just let it be the Wild Wild West and let them do what they see. Whatever they think they need to be successful.

[00:08:56] Craig: And, it's different when you talk with different business units within the organization. You know, I'm working with a client and, the manufacturing's task is I want 100 percent visibility onto my plant floor. And that is a great goal, and they are truly trying to achieve that. And security ops is let's put this tool out there and we'll come back and figure it out later And we're getting about I don't know.

[00:09:24] Craig: Let's call it 40 visibility and they're okay with that And in my mind the very first question I said is well What about the 60 blind spot you have that you don't have any visibility into at all? That should Gare you immensely. Well, but we're 40 percent better than we were but you're 60 percent from where you need to be

[00:09:46] Dino: Yeah, and with CIO or the CISO say the same thing about their enterprise. You know, as far as leaving off 50 or 60 percent of the assets that they don't have any visibility into at all. They're still connected to their network, but they're just ignoring them. The answer to that is no, and when you go back to the safety model, every plant has one or group of people who are responsible to ensure that the safety policies are being implemented and executed within their plan.

[00:10:15] Dino: Right. So when somebody shows up that they have on the proper PPE, that they're working safely, maybe have gone through some type of training to be in there inside that plant, and then there's always that watchful eye. So if somebody walks out on the plant floor without their, eye protection or their hard hat or their safety shoes, somebody's going to come go get them and run them out of there.

[00:10:37] Dino: You know, and fix that problem. You got to do the same thing with cybersecurity when it comes to that plan. You can have an enterprise global think on how you're going to do it, but you got to execute and you got to act locally because those plans, somebody has to be very aware and in tune to what that cybersecurity posture is, what those activities are to ensure your cybersecurity hygiene stays intact.

[00:11:01] Dino: And so it has to be done at some level of those people that are out there touching and working with that equipment every single day.

[00:11:08] Craig: yeah, if we circle back around to perception versus reality, it's the same thing. If I believe I'm 80 percent secure, is that reality? What am I basing that? Is that gut check? Is that I think it might be? Is it based on data? Reality, numbers, a continuous monitoring asset visibility tool that's telling me that.

[00:11:33] Craig: Is it a spreadsheet from 15 years ago? what data do you have to back that up? if I go to the grocery store and I stand in line and I see six people in front of me, I'm immediately going to say, it took me 15 minutes to get to the line. But if I were to set my watch. Reality is probably about two or three minutes at the most.

[00:11:54] Craig: But if I call that store, and I said, look, I stood in line for 15 minutes, there were 12 people in front of me. That's my perception. That's not reality. So you can't make decisions if they were trying to make staffing decisions off of that. You can't make decisions based on perception. I guess is what I'm trying to say.

[00:12:12] Dino: Yeah. Well, and what's leadership's role, in that perception at the end of the

[00:12:16] Craig: Yeah, for

[00:12:17] Dino: Because I've worked in many facilities where a corporate can set a particular policy and the plants just ignore it. You know, I've seen that, give great examples of remote access into the environment.

[00:12:28] Dino: For example, plants that put in their own DSL line to provide Internet connectivity in there for support. Because I don't want to work with IT because it takes too long, it's too costly when I need somebody in here right stinking now to get this, piece of equipment back up and running and if I'd go the IT route, it might take me a day or two or longer to get that done, Versus having it there ready to go, you know, at the beck and call when that phone rings at two o'clock on a Saturday night and my machine's not working, I can get an engineer in there to help me get it running.

[00:12:57] Craig: well, how does the organization step back 1 step and truly balance business need versus security posturing? what are the implications of the tools and technology that you're? Trying to implement on the business need if the business need is, I must produce 100, 000 widgets a day, regardless of what happens.

[00:13:24] Craig: that's okay. The business as a whole says that's important to me. But if I'm in security ops, and I say, you need to implement this patch or this update, and it's going to cost you to slip down in your production to 85, 000 widgets a day. Is that Okay. Is there a different way to achieve the same thing?

[00:13:45] Craig: Is there a different tool that still allows the business need to perform 100, 000 and for security to obtain what they need in the same place? That's what businesses are missing. I think.

[00:13:57] Dino: well, requires that you have to be in tune with the planned maintenance shutdowns and windows in order to implement those updates because they're not going to take their plant down just for a firmware update.

[00:14:10] Craig: Oh, no way.

[00:14:11] Dino: When they want to bring something plant down, it's usually because there's several or a dozen items of activity need to happen.

[00:14:18] Dino: That just happens to be one of them. You know, an update, The rest of it is cleaning and fixing and replacing. And they bring in groups to do that, and they coordinate that. And so, from an IT perspective, if your role and job is to execute improving cybersecurity posture, then you have to be in line with that and say you're going to have to have somebody working on a Saturday for the next two days, Saturday to Monday midnight, before they come back up to get your work done.

[00:14:47] Dino: have a back out plan. If your patch that you put in doesn't work, but you got to be in tune with that, Just like, I also think that those leadership needs to be a capital plan, so that, when your company is going to spend 50 million dollars over the next 5 years to do.

[00:15:01] Dino: Brownfield, Greenfield, lifecycle replacement, re control efforts, what have you, you're in tune with that capital plan to ensure that the cybersecurity technologies and services that are required to go around those machine centers are being implemented at the time. Those that engineering is being done, So when that machine or that skid comes into your plant, it's already got the cybersecurity components in it that you need in order to add it to your overall cybersecurity technology platforms that you have in place. All right,

[00:15:35] Craig: Well, giving. Organizations that saw that false sense of security. They believe they're being protected They believe they've got it under control. They believe that perception is we're all good We got this no worries. We're fine But the reality is there are still blind spots within that manufacturing Controls environment that they're not even aware back to they don't know what they don't know

[00:16:06] Dino: well, is everybody bought into it? Is the plant manager bought into it? Is engineering bought into it? Is operations bought into it? You know, is the production teams that bought into it? Are the OEMs bought into it? you got a lot of selling to do, right?

[00:16:19] Craig: yeah, you do

[00:16:20] Dino: Yeah, you

[00:16:20] Craig: for sure and there's a lot of stop gaps and a lot of I wouldn't say single contributors, but a lot of gating factors that have the authority to stop that plan at any point that it doesn't make sense for their business, you know, or their piece within that strategy.

[00:16:41] Dino: Well, and then, so that circles back around to the security framework. Do you have one? Pick one and start somewhere, right? You need to be able to begin somewhere. And if you have a framework, start working it. And just don't stop at the enterprise or just a few areas within the plant. You've got to consider all four corners of that manufacturing facility.

[00:17:05] Dino: When you're through this exercise, right, it just can't stop it. I T and at the network and at the systems that I T controls because there's all there's thousands of assets out there that are not underneath the domain of I T's control. Thousands of right

[00:17:22] Craig: there are more than they're on the I. T. side. So, yeah,

[00:17:24] Dino: back to your blind spots, right? So what stuff should they be taken framework?

[00:17:29] Dino: You have a framework. And start counting it through, not only just internally, but externally to your partners, that are responsible for, designing and building and maintaining and supporting those machine centers that you have.

[00:17:41] Craig: well, again, back to that asset visibility. You can't protect what you can't see. It's hard to do that. I know we talk a lot about, the sands 5 critical, Paths for OT security, and how they should leverage that as, part of that framework and, say, okay, where are we protected?

[00:18:02] Craig: Where are we not protected? And what do we need to focus on? You start with, okay, let's pick our, crown jewels. Let's pick our critical processes. You got to start somewhere,

[00:18:13] Dino: Arterial plants, if you got 50 plants, which ones are your top 10, Your highest producing, you know, manufacturing facilities and start with your A's and then make your way to your B's and make your way to your C's, right?

[00:18:26] Craig: Yeah. I agree. I think that, there's still some work to be done in the space. I think for organizations, again, you got to choose a partner that's aligned with what your business units and your business direction is someone that's in your space that understands what you do as an organization, fundamentally, that Understands control system integration, understands process and has access and a familiarity with the tools and the technologies that are OT centric built for this environment and start making friends with them.

[00:19:06] Craig: You got to start somewhere,

[00:19:09] Dino: And there's no reason not to get started, new. what you're going to experience and what comes at you is going to be new. But if this is just your entrance into this journey. Don't go alone.

[00:19:22] Craig: No, not at

[00:19:23] Dino: organizations that are out there that are doing this and have been doing this for a number of years, right, and help educate your teams, don't think that you've got the smartest cat in, in your organization that's got this all figured out because they don't. there's no way that they do. Otherwise, moving down the road and you'd already have a tool, you'd have it up and running, you'd have your governance, you'd have your framework, you'd have your policies, have your arms around your OEMs and system integrators to get them into the fold and what it is that you're trying to accomplish.

[00:19:52] Dino: You'd be doing all that stuff right now.

[00:19:55] Craig: you'd feel real warm and fuzzy about your cyber posture And I don't know one single board Or ceo that feels real warm and fuzzy that they've got everything under control and they can just kick back on their heels And let it coast

[00:20:09] Craig: It

[00:20:09] Craig: doesn't happen.

[00:20:10] Dino: doesn't exist. threat vectors keep expanding, the bad actors are getting smarter, now you're starting to add AI into the mix, which is going to speed things up good, bad, and indifferent in regards to this. So, It's a constant battle, and you gotta be diligent, and you gotta try to stay in front of it as much as you can, You're not gonna have the internal resources to pull this off. I don't care if you're a fortune one, you're gonna have to rely on partners to help you get through this. And,

[00:20:38] Craig: totally agreed. Great conversation, Dino. This, hopefully, brings some enlightenment to organizations that are trying to, again, go down this path, trying to figure this out. Perception is reality in some sense, and don't be fooled by something that you believe. Back it up with science back it up with data Make sure that you understand where you're at and don't just take someone's word for it trust but verify Verify the data

[00:21:07] Dino: and your cybersecurity, plan should encompass everything, right? Just like safety, back to that safety model, I don't care if it's the floor sweeper in the plant, all the way up to the plant manager, the safety protocols and governance and responsibility is the same for the plant manager as it is for the person sweeping the floors or running the plant.

[00:21:27] Dino: The operator on the line, they all know their responsibility to safety. You got to cyber security the same way. has to be at level that person that anybody who has responsibility for technology within your, manufacturing facility should have a base understanding of the cybersecurity protocols and responsibilities Policy governance and responsibilities on securing and protecting those assets, right? And the tools that you're using to do that. Not that they have to be the experts on it, but at least they know what the basics are.

[00:21:58] Craig: Yeah agree All right. Well, thanks everybody. I appreciate everyone listening and following continue for additional information for learning tips and we're here to help in any way we can you guys have a great day